Allow egress ips on managedseeds

[modzilla99]

What this PR does / why we need it:

With this PR the Controller will automatically allow the egress IPs of the ManagedSeed. This will fix the blackbox exporter check that tries to externally access the shoots API.

Special notes for your reviewer:
The ConfigMap called shoot-info will be present in Seed clusters that are itself shoots. So it will only work on ManagedSeed(-Sets).

[hown3d]

Thanks for the contribution!
I'd like to propose some changes.

[hown3d]

I was just thinking about wether we should add a check to only add the seed CIDR if the blackbox exporter is actually deployed.
This is configurable in the gardenlet configuration if monitoring is enabled:
https://github.com/gardener/gardener/blob/master/pkg/gardenlet/apis/config/v1alpha1/helper/helpers.go#L59-L59

@timebertt WDYT?

[modzilla99]

I was just thinking about wether we should add a check to only add the seed CIDR if the blackbox exporter is actually deployed. This is configurable in the gardenlet configuration if monitoring is enabled: https://github.com/gardener/gardener/blob/master/pkg/gardenlet/apis/config/v1alpha1/helper/helpers.go#L59-L59

@timebertt WDYT?

I would not know how to implement this. How would I get a hold of the gardenlet configuration to check it?

[timebertt]

I'm curious:
I suspect that allowing the egress IP of the seed cluster for the blackbox-exporter is not required for all setups. Typically, in-cluster clients of a LoadBalancer service directly talk to the clusterIP (due to an optimization by kube-proxy). I.e., the ACL should already allow the blackbox-exporter to access API servers on the same seed in most cases.

Can you outline your setup in detail?

• What kube-proxy mode are you using?
• How is the istio-ingressgateway service configured (traffic policy, and load balancer IP mode)